Add Sony X9000H (China) debloat list and device report

Tested on Sony BRAVIA X9000H (China, BRAVIA_VH1_CN), Android TV 12, build STT2.230505.001.S89. Reboot-checked and used for several days. Refs #659.

README.md

@@ -190,6 +190,7 @@ BYINTEK, JMGO, Portronics, Stellamore, Wanbo and XGIMI projectors
 | Sony BRAVIA KD-65X9300D (2016, SVP-DTV15, MediaTek), Asia-Pacific | Android TV 8.0 |
 | Sony BRAVIA TL2 (OD0M_EA_T32, TPV-built, MediaTek), Europe | Android TV 11 |
 | Sony BRAVIA VU31 4K (BRAVIA_VU31_4K, Realtek), India | Google TV 14 |
+| Sony BRAVIA X9000H (2020, BRAVIA_VH1_CN, MediaTek MT5895), China | Android TV 12 |
 | Sony BRAVIA XBR-65X900E (2017, BRAVIA_ATV2) | Android TV 9 |
 | Sony BRAVIA XBR-65X900F (2018, BRAVIA_ATV3_4K, MediaTek MT5891), US/Canada | Android TV 9 |
 | Stellamore T950S projector (Droidlogic be30a3, Amlogic txhd2) | Android 13 |

docs/devices/sony-x9000h-cn.md

@@ -0,0 +1,104 @@
+# Sony X9000H (China firmware): launcher handover and debloat notes
+
+Owner report for a China-market X9000H. The retail model was supplied by the owner; Android exposes
+the platform model, so a different regional X9000H may behave differently. A tested package list for
+this unit lives in [`examples/sony-x9000h-cn/debloat.txt`](../../examples/sony-x9000h-cn/debloat.txt).
+
+![Reference launcher on the X9000H](sony-x9000h-cn-home.png)
+
+## Observed firmware
+
+| Field | Observed value |
+|---|---|
+| Owner-reported retail model | Sony X9000H (KD-55/65/75X9000H family) |
+| Manufacturer | `Sony` |
+| Android model / product | `BRAVIA VH1` / `BRAVIA_VH1` |
+| Device | `BRAVIA_VH1` |
+| Android / API | `12` / `31` |
+| Build fingerprint | `BRAVIA_VH1_CN-user 12 STT2.230505.001.S89 625561 release-keys` |
+| Security patch | `2025-09-01` |
+| Application ABIs | `armeabi-v7a` |
+| RAM | 2,997,592 kB (~2.9 GB) |
+| Google client ID | `android-sonyfy20-tv` (China firmware: no GMS, no Play Store) |
+| SoC | MediaTek MT5895 (as reported by the owner) |
+
+`ro.build.characteristics` is `nosdcard,tv`. The `_CN` suffix appears in the fingerprint and build
+display id only; `getprop ro.product.model` reports the generic `BRAVIA VH1`.
+
+## Stock Home and handover
+
+The stock Home component on this unit was:
+
+```text
+com.dangbei.TVHomeLauncher/com.dangbei.leard.leradlauncher.ui.sony.main.MainActivity
+```
+
+It is 当贝桌面 ("电视桌面"), a system priv-app at
+`/system/system_ext/priv-app/ChinaHome.apk`. This firmware ships no Google TV / Android TV launcher;
+应用中心 is `com.sony.dangbeimarket`, a Dangbei store. Because Dangbei is not one of
+`build-and-install.sh`'s `KNOWN_STOCK_LAUNCHERS`, the script would refuse to guess it. The launcher
+was therefore built from main and installed with:
+
+```sh
+adb install -r launcher/app/build/outputs/apk/release/app-release.apk
+adb shell am start -W -n com.gathin.tvhome/.MainActivity      # Status: ok, cold start 926 ms
+adb shell cmd package set-home-activity --user 0 com.gathin.tvhome/.MainActivity
+```
+
+Dangbei was left enabled as the fallback (`STOCK_LAUNCHER=none`). After a `svc power reboot`:
+
+- `cmd package resolve-activity --brief -a android.intent.action.MAIN -c android.intent.category.HOME`
+  still resolved to `com.gathin.tvhome/.MainActivity`;
+- the launcher was the focused window after boot;
+- the Home key returned to it from the system Settings and from the input panel.
+
+The restore target is the Dangbei component above. It was never disabled, so restoring Home is a
+single `set-home-activity` call once the reference launcher is uninstalled.
+
+## Live TV and HDMI
+
+- Live TV / player package: `com.sony.dtv.tvx`, launcher activity `com.sony.dtv.tvx/.MainActivity`.
+- `KEYCODE_TV_INPUT` opened a `com.android.systemui` input window and Home returned to the reference
+  launcher, so the launcher's optional `InputKeyService` was not enabled.
+- The input framework itself was not exercised further: no HDMI source was switched and tuner
+  reception was not checked.
+
+Keep `com.sony.dtv.tvinput.*`, `com.sony.dtv.tvapi`, `com.sony.dtv.sonysystemservice`,
+`com.sony.dtv.sonyvendorservice`, `com.sony.dtv.settingsprovider`,
+`com.sony.dtv.systemupdate`/`update`, `com.sony.dtv.braviasync*`, `com.sony.dtv.partnerkeycn` (it
+holds enclave/DRM keys) and all `com.mediatek.*`. They drive HDMI, the tuner, DRM, OTA, CEC and the
+remote.
+
+## Debloat notes
+
+- 33 packages were disabled with `pm disable-user` (nothing uninstalled) and reboot-checked; five
+  more were already disabled at the factory (`mysony`, `livingfit`, `iot`, `b2b.vendorprotocol`,
+  `b2b.softap`). The list is in `examples/sony-x9000h-cn/`.
+- This China build has **no** Samba TV (`tv.samba.ssm`), no Google feedback package and no
+  `com.sony.dtv.promos` / `sonyselect` / `sonytab`. There is no Sony ACR or advertising ID to
+  remove here. The ad surfaces are the Dangbei home/store, HappyCast and the preinstalled content
+  apps.
+- Kept by the owner: `com.sony.dangbeimarket` (应用中心), `com.hpplay.happyplay.aw` (乐播投屏 —
+  the only casting path without Google Cast) and `com.dangbei.TVHomeLauncher`.
+- `com.sony.dtv.b2b.hotelmode` is `PERSISTENT`. `pm disable-user` sets `enabled=3` and its
+  components stop, but system_server still starts its process after a reboot (~6 MB PSS, measured
+  with `dumpsys meminfo`). Do not expect the process to disappear; the package is still disabled.
+- Disabling `com.sonyericsson.idd.agent` stops the Java agent, but the native `iddd` and
+  `idd-logreader` daemons (vendor `vendor.semc.system.idd`) keep running. Only root stops those.
+
+## Validation scope
+
+Checked over several days of use:
+
+- APK install, explicit launcher start (`Status: ok`), preferred-Home resolution, Home-key return
+  from Settings and from the input panel;
+- all 33 disables survived a `svc power reboot` (`pm list packages -d` still showed them);
+- the kept Dangbei store, HappyCast and Dangbei Home were still enabled;
+- no new crash appeared in `logcat -b crash` that was attributable to the disabled packages. The
+  boot log does contain pre-existing firmware crashes in `com.sonyericsson.dlna`,
+  `com.android.statementservice` and `com.mediatek.dmagent`, unrelated to this list.
+
+Not checked: cold boot from mains power-off, actual HDMI input switching, casting, voice input,
+tuner reception, DRM/Netflix playback, factory reset.
+
+This report omits the network address, serial numbers, Android ID and account details.

examples/README.md

@@ -93,6 +93,7 @@ on that firmware, grouped and commented. These are starting points: comment out
 | `sony-kd-65x9300d/` | Sony BRAVIA KD-65X9300D (2016, SVP-DTV15, MediaTek), Asia-Pacific | Android TV 8.0 | No Samba TV; Sony Select/Discover/BIVL, launcher customizer, Sony/Qterics device agents, SDDP vendorprotocol, tutorials, dead Play Music/Movies; DLNA, USB media, Vewd, Japanese keyboard off by choice; Chromecast, voice, Prime Video, HbbTV kept; 32-bit, 1.5 GB; Inputs lists HDMI 1-4 with CEC names; reboot-checked |
 | `sony-bravia-tl2/` | Sony BRAVIA TL2 (OD0M_EA_T32, TPV-built, MediaTek), Europe | Android TV 11 | TPV org.droidtv platform like the Philips 50PUS8517, not the usual Sony one: no Samba TV or Sony agents; retail demo, TPV partner auto-installs, Google feedback/Play Games; Prime Video, Disney+, Red Bull TV and preloaded games off by choice; stock tvlauncher off for the launcher; org.droidtv untouched, e-manual only hidden; Assistant, Chromecast, phone remote, updates kept; USB debugging alone opens 5555; ~1.7 GB; reboot-checked |
 | `sony-bravia-vu31/` | Sony BRAVIA VU31 4K (BRAVIA_VU31_4K, Realtek), India | Google TV 14 | First Realtek Sony list: no Samba/Qterics/IDD agents on this firmware; Sony promos/Select/tab, demo, help; Google feedback/Play Games/partner setup; ambient screensaver (basic dream set first); unused preloads off by choice; Alexa, Chromecast, AirPlay, Assistant kept; USB debugging alone opens 5555; 2 GB; launcher on a second set: setupwraith before launcherx, Live TV/HDMI in com.android.tv, Input key needs no service, applicationdisabler re-enables Eco Dashboard |
+| `sony-x9000h-cn/` | Sony BRAVIA X9000H (2020, BRAVIA_VH1_CN, MediaTek MT5895), China | Android TV 12 | China firmware with no Samba TV, no Google feedback and no Sony promos/Select/tab, so there is no Sony ACR to remove; Qterics/IDD/da.service, demo/help, no-camera packages, JD SmartService, 13 b2b hotel-mode packages and the kids profile off; Dangbei `ChinaHome` replaced by the reference launcher but kept enabled as fallback; Dangbei app store (应用中心) and HappyCast kept; b2b.hotelmode is persistent and its process still starts at boot; idle `iddd` remains; reboot-checked |
 | `sony-xbr-x900e/` | Sony BRAVIA XBR-65X900E (2017, BRAVIA_ATV2) | Android TV 9 | Samba TV ACR, Sony Select, My BRAVIA promos, Discover, device agents; Chromecast, DLNA, mirroring off by choice |
 | `sony-xbr-65x900f/` | Sony BRAVIA XBR-65X900F (2018, BRAVIA_ATV3_4K, MediaTek MT5891), US/Canada | Android TV 9 | Same build as the X900E on the next platform (ATV3); Samba TV, Sony Select/promos/Discover, Google recommendation rows, demo mode, device agents, Alexa setup app; Assistant, mirroring, DLNA, phone remote, USB players off by choice; Chromecast kept; the sponsored banner is the stock launcher's own |
 | `stellamore-t950s/` | Stellamore T950S projector (Droidlogic be30a3, Amlogic txhd2) | Android 13 | Zeasn App Store and stock launcher both bundle Google Ads (doubleclick); Zeasn device portal/OTA, Stellamore factory/test/guide; 1 GB; keystone correction must stay enabled |
@@ -170,6 +171,7 @@ Notes for models that have no tested list yet live in [`docs/devices/`](../docs/
 - [TCL BeyondTV AP08](../docs/devices/tcl-beyondtv-ap08.md), `RTD2851`, Android TV 9, patch `2021-01-05`: single-session launcher and package-change report, streaming apps/voice/casting preserved, physical remote and casting checked after restart; no several-day debloat list.
 
 - [Sony XR-75X91K (China firmware)](../docs/devices/sony-xr-75x91k-cn.md), owner-reported retail model, `BRAVIA 4K VH21` / `BRAVIA_VH21`, Android 12: ChinaHome launcher component, preferred-Home handover with stock Home enabled, Sony TV/input routing and explicit validation limits; no tested debloat list.
+- [Sony X9000H (China firmware)](../docs/devices/sony-x9000h-cn.md), `BRAVIA 4K VH1` / `BRAVIA_VH1`, Android 12 `STT2.230505.001.S89`, MediaTek MT5895: Dangbei `ChinaHome` as stock Home, `set-home-activity` handover with stock Home left enabled, a 33-package reboot-checked list, the persistent `b2b.hotelmode` process, native `iddd` still running, and the absence of Samba/Google feedback/promos on this China build.
 - [Sony K-85XR70](../docs/devices/sony-k85xr70-ae2.md), `BRAVIA 4K AE2`, Android 14, China, `114.602.170.1`: the UI runs at 1080p on a 4K panel by firmware, and a boot can bring the override density back as 640 (UI doubled and clipped) until `display_density_forced` is written as well as `wm density`; no debloat list.
 - [FPD CG50-C3](../docs/devices/fpd-cg50-c3.md), KTC-built `EcoTV Pro A` / `FPD_4KHA0`, MediaTek, Google TV 11 `RTM9.241015.016`, Canada: a one-day list, kept as a note for that reason; setupwraith owned a saved network that was not the one in use, so `FORCE_SETUPWRAITH=1` was safe; the RC-36 remote's gear and notifications buttons arrive as scancodes 240/362 with `KEY_UNKNOWN`/`KEY_PROGRAM`, so they need `settings_key_scancodes` rather than a keycode.
 - [Durabrand DB Android TV 4K `DURAT32ISDB`](../docs/devices/durabrand-durat32isdb.md) (`dupont`, m7332 Haier/CVTE board, Android TV 11 `RTM6.230109.232`): one-day owner report, ten packages, the two the firmware turns back on at every boot, the Input panel belonging to the MediaTek TV app instead of `tvlauncher`, and the hidden production menu that leaves Play services and Chromecast disabled until it is exited by hand.

examples/sony-x9000h-cn/debloat.txt

@@ -0,0 +1,87 @@
+# Sony BRAVIA X9000H (China), device BRAVIA_VH1_CN / product BRAVIA_VH1, MediaTek MT5895
+# Android 12 (Android TV, API 31), build BRAVIA_VH1_CN-user 12 STT2.230505.001.S89 625561 release-keys
+# China firmware (ro.com.google.clientidbase=android-sonyfy20-tv): no GMS, no Play Store and no
+# Google TV launcher. 2.9 GB RAM, armeabi-v7a only, security patch 2025-09-01.
+#
+# Apply:   TV_HOST=<tv ip> tools/disable.sh examples/sony-x9000h-cn/debloat.txt
+# Undo:    TV_HOST=<tv ip> tools/restore.sh examples/sony-x9000h-cn/debloat.txt com.dangbei.TVHomeLauncher
+# Everything is DISABLED, not uninstalled. Comment out any line you want to keep.
+#
+# Stock launcher/Home:
+#   com.dangbei.TVHomeLauncher/com.dangbei.leard.leradlauncher.ui.sony.main.MainActivity
+#   (当贝桌面 "电视桌面"; system priv-app /system/system_ext/priv-app/ChinaHome.apk)
+# It is NOT in build-and-install.sh's KNOWN_STOCK_LAUNCHERS, so install the reference launcher with
+# STOCK_LAUNCHER=none and leave Dangbei enabled as the fallback; `cmd package set-home-activity` was
+# used explicitly. Home survived a reboot.
+# Live TV / tuner app: com.sony.dtv.tvx (.MainActivity). Keep com.sony.dtv.tvinput.*, tvapi,
+# sonysystemservice, sonyvendorservice, settingsprovider, systemupdate/update, braviasync*,
+# partnerkeycn (enclave/DRM keys), preinappfiltering and all com.mediatek.*: they drive HDMI, the
+# tuner, DRM, OTA, CEC and the remote.
+# Kept by owner's choice: com.sony.dangbeimarket (应用中心, the Dangbei app store),
+# com.hpplay.happyplay.aw (乐播投屏/HappyCast, the only casting path without Google Cast) and
+# com.dangbei.TVHomeLauncher (fallback Home). Preinstalled content apps (银河奇异果, 芒果TV,
+# NewTV极光, 央视频TV, CIBN酷喵, 油桃TV) are not listed either; disable them individually if unused.
+# Already disabled at the factory: com.sony.dtv.mysony, livingfit, iot, b2b.vendorprotocol, b2b.softap.
+#
+# Quirks on this firmware:
+# - There is no tv.samba.ssm, no com.google.android.feedback and no
+#   com.sony.dtv.promos/sonyselect/sonytab. The Sony ACR/ad-ID stack is absent on this China build;
+#   ad surfaces are the Dangbei home/store, HappyCast and the preinstalled content apps.
+# - com.sony.dtv.b2b.hotelmode is PERSISTENT: pm disable-user marks it disabled and its components
+#   stop, but system_server still starts the process at boot (~6 MB PSS). Reboot-checked.
+# - com.sonyericsson.idd.agent can be disabled, but the native iddd / idd-logreader daemons
+#   (vendor.semc.system.idd) keep running; only root stops them.
+# - KEYCODE_TV_INPUT opens the system input panel without the launcher's InputKeyService.
+# - ro.product.model / ro.product.device report "BRAVIA VH1"/"BRAVIA_VH1"; only the fingerprint and
+#   build display id carry the _CN suffix.
+# - Reboot-checked and used for several days without issues. If something breaks,
+#   `pm enable <package>` and please open an issue.
+
+# telemetry and remote support
+com.qterics.da.product                  # Qterics device agent
+com.sony.dtv.da.service                 # remote-support session service
+com.sonyericsson.idd.agent              # Sony IDD usage-data agent
+com.sony.dtv.usercontext                # user context providers, boot receiver only
+com.sony.dtv.sonybugreportsys           # Sony bug-report/log uploader
+
+# demo / shop mode
+com.sony.dtv.demosupport
+com.sony.dtv.demosystemsupport
+com.sony.dtv.multiscreendemo
+
+# help content: the Settings help tiles disappear
+com.sony.dtv.customersupport
+com.sony.dtv.smarthelp
+com.sony.dtv.helpguidecontents
+
+# no camera on this model (BRAVIA CAM / sensing camera)
+com.sony.dtv.gestureapp
+com.sony.dtv.sensingcamera.fwupdate
+com.sony.dtv.sensingcamera.settings
+com.sony.dtv.sensingfusionservice
+com.sony.dtv.videochatrecord
+
+# features the owner did not use
+com.sony.dtv.distancealert
+com.sony.dtv.ecodashboard
+
+# China-only bloat
+com.jd.smartservicetwo                  # JD SmartService
+
+# hotel / B2B mode (consumer set; 13 packages)
+com.sony.dtv.b2b.adminpassword
+com.sony.dtv.b2b.deviceadminsettings
+com.sony.dtv.b2b.frameworkextension
+com.sony.dtv.b2b.hotelmode              # PERSISTENT process survives a reboot; components disabled
+com.sony.dtv.b2b.importexport
+com.sony.dtv.b2b.ipcontrolsettings
+com.sony.dtv.b2b.noderuntime.normal
+com.sony.dtv.b2b.noderuntime.privilege
+com.sony.dtv.b2b.noderuntimeextension.bpk
+com.sony.dtv.b2b.noderuntimeextension.node_20_11_1
+com.sony.dtv.b2b.prosettings
+com.sony.dtv.b2b.rs232csupport
+com.sony.dtv.b2b.webappruntimedrm
+
+# kids profile
+com.sony.dtv.kidsprofileadapter